SUBPROCESSORS
Scholars Beacon LLC, doing business as Crackd
Last updated: April 27, 2026
Scholars Beacon LLC (dba Crackd) uses the third-party service providers listed below ("subprocessors") to deliver the Services. All subprocessors are bound by their commercial or API terms, which prohibit using customer data for model training. We will notify contracting educational institutions at least 30 days before adding or changing any subprocessor that handles student data.
These subprocessors may process personal information or student data in the ordinary course of providing the Services.
Subprocessor | Service / Purpose | Data Category | Location | Privacy / DPA |
Amazon Web Services (AWS) | Cloud infrastructure: S3 object storage (uploads, voice recordings, question images), backend compute, encrypted volumes | Account data, user-uploaded content, voice audio, system logs | United States | aws.amazon.com/privacy |
MongoDB Atlas | Primary database: user accounts, chat sessions, practice attempts, progress data | Account data, student educational data | United States | mongodb.com/legal/privacy/privacy-policy |
Vercel | Frontend application hosting | HTTP request metadata (IP, user agent); no application data | United States | vercel.com/legal/privacy-policy |
Anthropic | AI tutoring (Claude API). Processes prompts including student-authored content. Does not train on customer data. API logs retained ≤7 days. | AI tutor prompts and responses (may contain student-authored content) | United States | anthropic.com/legal/privacy |
OpenAI | AI tutoring and content generation. Does not train on API data by default. Logs retained ≤30 days. | AI tutor prompts and responses | United States | openai.com/policies/privacy-policy |
Google (Gemini API, paid tier) | AI tutoring. Paid tier — Google does not use data for model training. Governed by Google Cloud DPA. | AI tutor prompts and responses | United States | cloud.google.com/terms/cloud-privacy-notice |
Stripe | Payment processing for paid subscriptions | Billing details, payment method, transaction history | United States | stripe.com/privacy |
Resend | Transactional email delivery (account verification, password reset, billing notifications) | Email address, message content | United States | resend.com/legal/privacy-policy |
These services are used for site analytics and ad-conversion attribution. They are not loaded on authenticated student application pages. They run only for anonymous visitors on marketing pages and on the /success checkout-confirmation page. They do not receive student educational data (practice responses, AI tutor conversations, progress records).
Subprocessor | Service / Purpose | Configuration | Privacy / DPA |
Google Analytics 4 | Aggregate site usage analytics for marketing pages | Google Signals disabled for Connecticut; Ads Personalization Signals disabled for Connecticut; Account-level data sharing disabled; Event retention set to 2 months; IP anonymization on by default | policies.google.com/privacy |
Google Ads | Conversion tracking for paid advertising | Loaded only on anonymous marketing routes and the post-checkout /success page; not present on authenticated student pages | policies.google.com/privacy |
Meta (Facebook Pixel) | Conversion tracking for paid advertising | Loaded only on anonymous marketing routes and /success; not present on authenticated student pages | facebook.com/privacy/policy |
Date | Change |
April 27, 2026 | Initial subprocessor list published. |
If you have questions about our subprocessors or data handling practices, please contact us at:
Scholars Beacon LLC
11040 Bollinger Canyon Road, Suite E 917
San Ramon, CA 94582
United States
Email: scholarsbeacon@gmail.com
Phone: (925) 413-1523